Disinformation and Brand Impersonation: Detect and Respond

Fake social accounts, cloned websites, scam adverts and fabricated statements in your organisation's name defraud customers and move markets, and most of it happens on infrastructure you do not control. Brand impersonation borrows your name, logo and executives to steal money or credentials; disinformation uses the same assets to spread false claims about you. Both are cheap to launch, and generative AI has made convincing fake personas, sites and media trivial to produce. This guide explains how these campaigns work, how to detect them early, which takedown routes exist (platform reporting, registrars and hosts, UDRP, national reporting services, EU Digital Services Act trusted flaggers, UK Online Safety Act duties), and how to measure the programme. It is for security operations, threat intelligence, fraud, legal and communications teams who share the problem.

Key takeaways

It is a fraud and an incident, not only a marketing issue. Impersonation sites and accounts harvest customer credentials and payments, so they belong in the security incident process with clear owners in legal and communications.
Make the real channels provable. Verified accounts, a published list of official domains and channels, and authenticated email give customers and platforms a reference to compare against.
Monitor continuously. New domain registrations, certificate logs, social platforms, app stores and ad libraries all show impersonation before most customers notice it.
Know every takedown route in advance. Platform reporting, hosting and registrar abuse desks, UDRP, national reporting services and DSA trusted flaggers each work on different timescales and evidence standards.
Answer disinformation fast with evidence. Pre-agreed statements, a rumour control page and spokespeople ready to debunk on official channels limit the damage of a fabricated story or deepfake.

How the attack works

Most campaigns combine three building blocks: an identity that looks like yours, a channel to reach your audience, and a payload (a payment request, credential form, malware download or false narrative). CISA's "Tactics of Disinformation" series describes the same toolkit from the influence side: fake personas and websites, deepfakes and cheapfakes (real media taken out of context), astroturfing that floods a topic with bot accounts, exploiting data voids where little credible information exists, and recruiting unwitting influencers to repeat a narrative.

Technique	Example	Reference
Fake social media accounts	Customer support "help" account replying to complaints with phishing links; fake executive profile announcing a giveaway	ATT&CK T1585.001 Social Media Accounts
Hijacked genuine accounts	A compromised verified account renamed to impersonate a brand, gaining instant credibility	T1586.001 Social Media Accounts (compromise)
Lookalike domains and cloned sites	Copied login or checkout page on a similar domain, often with a valid TLS certificate	T1583.001 Domains
Scam adverts and search poisoning	Paid ads or optimised pages for "brand + support" or "brand + login" leading to fake sites	T1583.008 Malvertising; T1608.006 SEO Poisoning
Synthetic media	Deepfaked executive video promoting an investment scheme or announcing false news	ATLAS AML.T0088 Generate Deepfakes
Direct impersonation of staff	Messages posing as the company's recruiters or account managers	T1684.001 Impersonation

The NSA, FBI and CISA joint sheet on deepfake threats lists brand manipulation as a core organisational risk: convincing executive audio or video released on social media to damage reputation or share price before it can be stopped. Campaigns also feed on themselves: the FBI's December 2025 warning (I-121925-PSA) describes attackers reusing stolen contact lists to impersonate each previous victim to the next.

Where it shows up

Social platforms: fake brand pages, fake support handles, fake executive profiles and fake recruiter accounts.
Websites and domains: cloned login, payment, investor relations or job application pages. See the Phishing Guide.
Email and messaging: spoofed sender domains and lookalike addresses. Enforcing DMARC on every domain you own, including parked ones, is covered in the DMARC, SPF and DKIM Guide.
Advertising and search: scam ads using your logo or a celebrity endorsement, and search results for support phone numbers that lead to fraudsters. See the Callback Phishing (TOAD) Guide.
App stores and marketplaces: fake apps and counterfeit listings using your brand.
Underground forums and channels: phishing kits targeting your brand, and sale of stolen customer data. See the Dark Web Monitoring Guide.

Impact

Customer fraud: credentials and payment details captured on cloned sites; refunds, complaints and account takeover follow. See the Account Takeover Prevention Guide.
Market and reputational harm: in November 2022 a paid-verified impostor account on Twitter claimed Eli Lilly would make insulin free. Lilly apologised for the "misleading message" and its shares fell more than 5 per cent the next day, although Semafor noted it was unclear how much the tweet caused the fall.
Operational load: support teams handle victims, legal handles takedowns, communications handles press, often in parallel.
Trust erosion: once customers have been fooled, they distrust genuine messages, which lowers the effectiveness of legitimate security notices.

Detection

Source	What it reveals	Practical notes
New domain registrations and zone files	Lookalike domains containing your marks or misspellings	Score by similarity, MX record presence and hosting; watch parked domains that later go live
Certificate Transparency logs	TLS certificates issued for names containing your brand	Often the first sign a phishing site is about to go live
Social platform search and monitoring	Accounts using your name, logo or executives' photos	Check creation date, follower patterns and reply behaviour, as CISA suggests for spotting inauthentic accounts
Ad libraries and search results	Paid ads and sponsored results using your brand terms	Search your brand plus "login", "support", "refund" regularly
DMARC aggregate reports	Unauthorised mail claiming to be from your domains	Also reveals forgotten legitimate senders before enforcement
Customer and staff reports	Fake sites, calls and messages seen in the wild	Provide a single reporting address and web form; feed them to the SOC queue
Web analytics and referrers	Cloned pages loading your images or scripts, unusual referrers to login	Hotlinked assets often betray a copied page
Narrative monitoring	Trending false claims, hashtags and data voids about your organisation	Communications team owns it, with escalation into the incident process

Metrics

Time to detect: median hours from a lookalike domain or account appearing to your detection.
Time to takedown: median hours from report to removal, split by route (platform, host, registrar, UDRP).
Takedown success rate: percentage of reported items removed within 7 days.
Repeat offenders: share of impersonations reappearing on the same registrar, host or platform within 30 days.
Customer harm: number of customer fraud cases attributed to impersonation per month.
DMARC coverage: percentage of owned domains at p=reject.

Prevention and hardening

Make the genuine identity easy to verify

Official channel register: publish one page listing your official domains, social handles, apps and support numbers, and link it from every channel. CISA recommends keeping official information current and verifying official accounts.
Verified accounts: obtain platform verification for corporate and key executive accounts, and secure them with phishing-resistant MFA and named owners so a hijack cannot rebrand them.
Defensive registrations: register the most likely misspellings and key country domains, point them at your main site and publish DMARC p=reject on all of them.
Customer messaging rules: state publicly what you will never ask for (passwords, one-time codes, payment by gift card) so customers can recognise a fake.
Provenance for official media: consider content credentials (C2PA) on official video and statements, as the NSA, FBI and CISA sheet suggests, so genuine material can be proven.

Takedown routes

Route	Use for	What to expect
Platform impersonation reporting	Fake accounts and pages	X prohibits posing as a real person or organisation using at least two identity elements (name, image, false affiliation) and may need a report from the portrayed party; parody accounts must be labelled. Meta provides a Report flow on the profile and a form for non-users
Hosting provider and registrar abuse desks	Live phishing or cloned sites	Fastest for clearly malicious content; send URL, screenshots, timestamps and evidence of credential capture
National reporting services	Scam sites in the UK	The NCSC website reporting form accepts any number of URLs and works with hosting companies to remove malicious sites; it does not report outcomes. Losses go to Report Fraud or Police Scotland
WIPO UDRP	Domains registered in bad faith that remain a threat	Must prove confusing similarity to a mark, no legitimate interest, and registration and use in bad faith; transfer or cancellation, no damages; about two months; USD 1,500 filing fee for 1 to 5 domains with a single panelist
EU DSA trusted flaggers	Illegal content on online platforms in the EU	Status granted by the Digital Services Coordinator of the Member State where the entity is established, to EU-based entities that are expert, independent of platforms and accurate; platforms must give their notices priority. The Commission publishes the list
UK Online Safety Act fraudulent advertising duties	Scam ads on the largest platforms and search services	Applies to Category 1 and Category 2A services. Ofcom consulted on draft codes from 10 July to 2 October 2026 and plans its final statement by mid-2027, so the codes are not yet in force

Ofcom's draft fraudulent advertising measures include verifying that people setting up advertising accounts work for the business they claim to represent, checking that advertisers of financial services are authorised, stronger account security against hijacking, and a dedicated reporting channel for law enforcement. Brand owners outside the EU cannot become DSA trusted flaggers themselves, but can work with organisations that hold the status. Treat both regimes as developing and check current status before relying on them.

How to implement

Assign ownership (month 1): name an owner in security or threat intelligence, with agreed roles for legal (trademark, UDRP), communications (statements, rumour control) and fraud (customer harm). Record it in the incident response plan (NIST SP 800-53 IR-8).
Inventory your identity (month 1): list marks, domains, social handles, executive profiles and apps; publish the official channel register.
Harden (months 1 to 2): verification and MFA on official accounts, defensive registrations, DMARC enforcement after a monitoring period at p=none so legitimate senders are not blocked.
Start monitoring (months 2 to 3): domain and certificate monitoring, social and ad searches, and a reporting address for customers and staff. Tune scoring for a few weeks before alerting on every hit to avoid analyst overload.
Build the takedown kit: evidence template (URL, screenshots, WHOIS, hosting, timestamps, victim reports), contacts for platforms and abuse desks, trademark certificates for UDRP and platform forms.
Prepare for disinformation: holding statements, a rumour control page and an approval path for rapid debunks, rehearsed in a tabletop. See the Crisis Management Guide.
Review quarterly: track the metrics above, adjust monitoring terms, and retire defensive domains that bring no value.

Decision guidance

In-house or managed service: small organisations can cover the basics with free certificate log searches, platform reporting and the NCSC form; organisations with many brands, consumer customers or frequent phishing kits usually need a managed takedown service with registrar relationships and 24-hour coverage.
Abuse report or UDRP: use abuse reports for live malicious content (hours to days); use UDRP when a domain is parked or keeps coming back and you want control of it (weeks, fee, legal effort).
Respond publicly or not: a small fake account may be best removed quietly; a viral false claim or deepfake needs a fast, evidenced public correction on official channels, as CISA recommends.

Lessons from incidents

Paid verification is not identity: the Eli Lilly impostor carried a purchased verification badge. Teach customers to rely on your official channel register, not badges.
Deepfaked executives create both fraud and disinformation: the Arup deepfake fraud shows how convincing synthetic executives have become; the same capability used publicly becomes brand manipulation. See the Deepfake and AI Impersonation Guide.

Common failure patterns

No owner: marketing, legal and security each assume another team handles fake accounts, so nothing is reported.
Takedown without evidence: reports lacking screenshots, timestamps and proof of harm are rejected or delayed.
Whack-a-mole only: removing sites one by one without tracking registrars, hosts and kits that recur.
Unprotected official accounts: a hijacked verified account does more damage than any fake, because it is genuinely yours.
Slow statements: waiting days to correct a false claim lets it become the accepted version.
Ignoring parked lookalikes: domains with MX records but no website are often used for email fraud before any site appears.

Framework mapping

Framework	Reference	How it applies
NIST CSF 2.0	ID.RA-03; DE.AE-02; RS.CO-02; RS.MA-01	Recording impersonation threats, analysing reports, notifying stakeholders, coordinating takedown with third parties
NIST SP 800-53 Rev. 5	PM-16 Threat Awareness Program; SI-4 System Monitoring; IR-8 Incident Response Plan; AT-2(3) Social Engineering and Mining	Threat intelligence sharing, monitoring, response roles, awareness
ISO/IEC 27001:2022 Annex A	A.5.7 Threat intelligence; A.5.24 Incident management planning	Monitoring and response preparation
MITRE ATT&CK v20	T1585.001; T1586.001; T1583.001; T1583.008; T1608.006; T1684.001	Detection use cases for resource development and impersonation

Practitioner checklist

Name an owner and document legal, communications and fraud roles in the incident response plan.
Publish an official channel register and link it from every official channel.
Verify and secure corporate and executive accounts with phishing-resistant MFA and named owners.
Enforce DMARC p=reject on all owned domains, including parked and defensive ones.
Monitor new domains, certificate logs, social platforms, app stores and ad libraries for your marks.
Keep a takedown kit with evidence templates, abuse contacts and trademark documents.
Know the route for each case: platform report, abuse desk, NCSC, UDRP or a DSA trusted flagger.
Prepare holding statements and a rumour control page, and rehearse a deepfake scenario.
Track time to detect, time to takedown and repeat offenders quarterly.

Standards and references

Related NHI Mgmt Group resources: Phishing Guide · DMARC, SPF and DKIM Guide · Dark Web Monitoring Guide · Threat Intelligence Guide

Disinformation and Brand Impersonation Guide: Fake Accounts, Sites and Response